ForceMemo Uses Account Takeovers and Force-Pushes to Infect Hundreds of GitHub Python Repositories
Summary
StepSecurity reports that ForceMemo is injecting malware into hundreds of GitHub Python repositories via account takeovers and stealthy force-pushes. Its analysis traces the payload to Solana-memo C2 and observes Node.js-based execution in a controlled run.
Key points
- StepSecurity identified an ongoing campaign affecting hundreds of GitHub accounts and Python repositories, with injections detected from March 8, 2026.
- The attacker reportedly uses stolen GitHub credentials to rebase default branches and force-push malware, preserving original commit metadata; newer committer dates and the committer email "null" can expose tampering.
- StepSecurity attributes credential theft to GlassWorm-infected VS Code and Cursor extensions; cited token sources include Git credential helpers, VS Code storage, ~/.git-credentials and GITHUB_TOKEN.
- The injected Python code is appended to project files and decoded using base64, zlib and XOR with key 134. The shared marker is lzcdrtfxyqiplpd, and running or installing affected repositories can trigger the code.
- The malware retrieves payload instructions from Solana transaction memos and uses nine RPC endpoints as fallbacks. On-chain analysis found six rotated payload-server IPs.
- In a controlled GitHub Actions run, StepSecurity observed Solana and payload-server connections and a Node.js v22.9.0 download. The analysis says the malware uses Node.js to execute an encrypted JavaScript stage and creates i.js and ~/init.json.
- StepSecurity found that ForceMemo's Solana C2 wallet was also used by GlassWorm, suggesting—but not proving—a shared actor. Users of Python packages installed directly from GitHub are advised to check for the malware marker and related files.
Article Details
- Attack Vectors
- GlassWorm malware delivered through malicious VS Code and Cursor extensions steals GitHub tokens from developer credential sources.
- Attackers use stolen GitHub credentials to rebase legitimate default-branch commits with obfuscated Python malware appended to project files, then force-push the altered commits.
- Running a compromised repository's setup.py, including through pip install, or cloning and executing its code triggers the malware.
- The malware decodes and executes its Python payload, queries Solana transaction memos for instructions, and downloads Node.js and an encrypted JavaScript payload from rotating servers.
- The malware checks system locale, timezone, and UTC offset and skips execution on systems it identifies as Russian.
- Defensive Notes
- Search Python files for the marker variable lzcdrtfxyqiplpd.
- Check for the persistence file ~/init.json, downloaded Node.js files matching ~/node-v22*, and i.js in recently cloned project directories.
- Review repository commit histories for commits whose committer dates are substantially newer than their author dates, and verify default-branch code against the last legitimate commit.
- Monitor outbound network connections from CI runners and block connections that are not on an approved allowlist; the article reports Harden-Runner detected the malware's Solana RPC, payload-server, and Node.js download connections.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| IPV4 | 217[.]69[.]0[.]159 | Payload server IP identified in Solana C2 memos; the article reports a controlled execution connected to it. |
| IPV4 | 217[.]69[.]11[.]57 | Payload server IP identified in Solana C2 memos; reported active in February 2026. |
| IPV4 | 217[.]69[.]11[.]99 | Attacker infrastructure identified in on-chain C2 configuration as a C2 and victim-fingerprinting server. |
| IPV4 | 45[.]32[.]150[.]97 | Payload server IP identified in Solana C2 memos; reported active in February 2026. |
| IPV4 | 45[.]32[.]151[.]157 | Payload server IP identified in Solana C2 memos; reported active from December 2025. |
| IPV4 | 45[.]76[.]44[.]240 | Payload server IP identified in Solana C2 memos; reported active in March 2026. |
| URL | hxxp[:]//217[.]69[.]11[.]99 | Victim IP-fingerprinting endpoint explicitly listed in an attacker configuration posted to a Solana transaction memo. |
| URL | hxxp[:]//217[.]69[.]11[.]99:5000 | C2 server URL explicitly listed in an attacker configuration posted to a Solana transaction memo. |
MITRE ATT&CK
T1027 · Obfuscated Files or InformationThe injected code is obfuscated with base64 encoding, zlib compression, XOR encryption, and randomized variable names.T1059.006 · PythonThe injected Python code runs from project files such as setup.py and executes the decoded Python payload.T1059.007 · JavaScriptThe malware uses downloaded Node.js to decrypt and execute the encrypted JavaScript payload.T1071.001 · Web ProtocolsThe malware communicates with Solana RPC endpoints and retrieves payloads using HTTP or HTTPS connections.T1078.004 · Cloud AccountsThe attacker uses stolen GitHub credentials to access developer accounts and push changes to their repositories.T1102.001 · Dead Drop ResolverThe malware queries Solana transaction memos for payload URLs and instructions, using the blockchain as a dead-drop source.T1105 · Ingress Tool TransferThe malware downloads Node.js v22.9.0 and an encrypted JavaScript payload from its infrastructure.T1140 · Deobfuscate/Decode Files or InformationAt runtime, the Python wrapper base64-decodes, decompresses, and XOR-decrypts the embedded payload before executing it.T1195.001 · Compromise Software Dependencies and Development ToolsThe article identifies malicious VS Code and Cursor extensions as the GlassWorm infection route used to steal developer credentials.T1552.001 · Credentials In FilesGlassWorm's credential-theft module reportedly harvests GitHub tokens from ~/.git-credentials and VS Code extension storage.T1565.001 · Stored Data ManipulationThe attacker rebases legitimate repository commits with malware appended and force-pushes the altered commits to default branches.T1614.001 · System Language DiscoveryThe malware examines locale settings, timezone, and UTC offset to identify Russian systems and skip execution.
Threat Actors
Malware
Vendors
Products
Cursorthe compromised developers were infected with the GlassWorm malware through malicious VS Code and Cursor extensions. GlassWorm's stage 3 payload includes a dedicated credential theft module that harvests GitHubGitHubThe StepSecurity threat intelligence team has discovered an ongoing campaign in which an attacker is compromising hundreds of GitHub accounts and injecting identical malware into hundreds of Python repositories.Node.js# "Эмуляция объекта Buffer из Node.js" (Emulation of Node.js Buffer object)VS Codebeen identified: the compromised developers were infected with the GlassWorm malware through malicious VS Code and Cursor extensions. GlassWorm's stage 3 payload includes a dedicated credential theft module that